Email & deliverabilityPractical guide · updated for 2026
How to Set Up SPF, DKIM and DMARC for a Domain
Publish one SPF record listing your real senders, add the DKIM keys your provider gives you, then publish a DMARC record starting in monitor mode. Change one thing at a time and check the DNS before sending.
Have this ready
- DNS access for the domain
- The DKIM values from each sending provider
- A test mailbox you can check headers in
Step by step
- 1List every service that sends mail as your domain: mailbox host, marketing tool, invoicing system and website forms.
- 2Create one SPF TXT record at the root that includes each sender and ends with a hard fail, and keep it under the lookup limit.
- 3Add the DKIM records your providers publish, usually as CNAME or TXT at a selector subdomain.
- 4Publish a DMARC record at _dmarc with a monitoring policy first so reports arrive before anything is enforced.
- 5Send a test to a mailbox you control and check the authentication results in the headers.
- 6Review the reports for legitimate sources you missed, then tighten DMARC to quarantine or reject.
- 7Set a reminder to review the records when you add or remove a sending tool.
Want it done with you?
I can walk you through it in a Magic Box, show you the exact clicks, or do it with you and keep the recording. You log in yourself; I never see your password.
Common questions
Do I need all three?+
SPF and DKIM authenticate a message; DMARC tells receivers what to do when both fail and gives you reports. All three together is what receivers expect.
How many SPF lookups are allowed?+
Ten DNS lookups is the practical limit. Too many includes is the usual cause of an SPF permerror.
Can I have two SPF records?+
No. Multiple SPF records break the check. Merge them into one record on the root domain.